Software Key Manager Using Salt-Derived Segmented Encryption
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Existing encryption methods face challenges in securing data in software-based systems, as they often rely on expensive hardware for key obfuscation and are vulnerable to brute force cracking due to predictable pseudo random number generators (PRNGs) and lack of secure KEK storage, leading to potential key compromise.
Innovation Solution
A system that uses a key manager to generate and manage encryption keys, employing a pseudo random string of bytes and a unique hash value to associate keys with users, without relying on a key encrypting key (KEK), and incorporates a PRNG to create a set of base characters for enhanced entropy and security, while also using a token and checksum to prevent brute force cracking.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Reliability
If symmetrical encryption algorithms are used with a key for both encrypting and decrypting data, then data can be securely encrypted, but anyone in possession of the key is able to decrypt the data
Solution Approach 1:
The encryption key is segmented into multiple components: a secret salt value and multiple key derivatives generated through different paths. The first key derivative is generated from the salt, while subsequent key derivatives are generated from both the salt and previous key derivatives, creating a segmented key structure where compromise of one segment does not reveal all segments.
Solution Approach 2:
A secret salt value is preliminarily generated and stored securely before the actual encryption process. This salt is used to derive multiple key derivatives in advance, and the system is configured to use different numbers of key derivatives for different encryption operations, preventing retrospective key recovery even if future security requirements change.
2Reliability
If key obfuscation technologies employing a master key (KEK) are used to encrypt the data key, then key security is improved, but the system requires relatively expensive hardware and does not work well in software-based systems
Solution Approach 1:
The patent replaces the mechanical hardware-based key obfuscation system with a software-based cryptographic approach using salt-derived key derivatives. Instead of relying on physical hardware security modules, the system uses computational cryptography with a secret salt and iterative key derivation functions that can be implemented entirely in software, making it suitable for software-based systems and consumer environments.
3Ease of operation
If a pseudo random number generator (PRNG) is used to generate random sequences, then software-based random generation is achieved, but the resultant pseudo random sequence is potentially predictable and poses a risk under the threat of being guessed
Solution Approach 1:
The patent changes the parameters of random sequence generation by introducing a secret salt value that is periodically updated. Instead of using a fixed PRNG seed, the system uses a changing salt parameter that derives different key derivatives over time. This parameter change ensures that even if the PRNG algorithm is predictable, the changing salt prevents prediction of future key derivatives, mitigating the predictability risk while maintaining software-based operation.
Data Source
Figure 1~3
Figure 4~5
Figure 6~7
AI summary
A system and associated methods for encrypting data are disclosed. In at least one embodiment, a key manager is located in memory on an at least one computing device and configured for creating and managing an at least one encryption key to be used for encrypting the data. An at least one key file is also located in memory on the at least one computing device and is associated with an at least one authorized user. The key file contains a key field comprising a pseudo random string of bytes and a unique hash value used to associate the key file to the user. A set of base characters are randomly selected from the key field, such that the base characters are a subset of the key field. An encryption key is generated by inputting the base characters into an encryption algorithm. The data is encrypted using the encryption key.